ECSU Net-Centric

Computing
This WordPress.com site is the bee's knees

Home Chapter 1 Problems Chapter 2 Problems Chapter 3 Problems

Chapter 4 Problems Wireshark Lab 1 Wireshark Lab 2 Wireshark Lab 3

Wireshark Lab 4

Chapter 2 Problems
Chapter 2 P4, P6, P7, P10, P15, P17, P18, P22, P23, P32

Problem 4
Consider the following string of ASCII characters that were captured
by Wireshark when the browser sent an HTTP GET message (i.e., this
is the actual content of an HTTP GET message). The characters
<cr><lf> are carriage return and line-feed characters (that is, the
italized character string <cr> in the text below represents the single
carriage-return character that was contained at that point in the HTTP
header). Answer the following questions, indicating where in the HTTP
GET message below you find the answer.

GET /cs453/index.html HTTP/1.1<cr><lf>Host:

gaia.cs.umass.edu<cr><lf>User-Agent0 ( Windows;U; Windows NT 5.1; en-
US; rv:1.7.2) Gec ko/20040804 Netscape/7.2 (ax) <cr><lf>Accept:ext/xml,
application/xml, application/xhtml+xml, text /html;q=0.9,
text/plain;q=0.8,image/png,*/*;q=0.5 <cr><lf>Accept-Language: en-
us,en;q=0.5<cr><lf>Accept- Encoding: zip,deflate<cr><lf>Accept-Charset:
ISO -8859-1,utf-8;q=0.7,*;q=0.7<cr><lf>Keep-Alive: 300<cr>
<lf>Connection:keep-alive<cr><lf><cr><lf>

a. What is the URL of the document requested by the browser?

The URL of the document requested is:
gaia.cs.umass.edu/cs453/index.html
b. What version of HTTP is the browser running?
The version of HTTP that the browser is running is HTTP 1.1.
c. Does the browser request a non-persistent or a persistent
connection?
The browser requests a persistent connection.
d. What is the IP address of the host on which the browser is running?
The host’s IP is gaia.cs.umass.edu.
e. What type of browser initiates this message? Why is the browser
type needed in an HTTP request message?
Netscape 7.2 is being used. The browser type is needed because different
browsers interpret web pages differently. This is because HTTP
specifications only define protocol for interaction between server and and
client programs.

Problem 6
Obtain the HTTP/1.1 specification (RFC 2616). Answer the following
questions:
a. Explain the mechanism used for signaling between the client and
server to indicate that a persistent connection is being closed. Can the
client, the server, or both signal the close of a connection?
The mechanism used for signalling between client and server to indicate
that a persistent connection is being closed is a connection-token with
closing information on it. The request to this token is the last message sent.
Both the client and the server can send these closing tokens.
b. What encryption services are provided by HTTP?
There are no encryption services provided by HTTP.
c. Can a client open three or more simultaneous connections with a
given server?
A client can open as many connections as they desire with a given server.
RFC2616 states that clients should limit simultaneous connections and
should not maintain more than two with any server or proxy.
d. Either a server or a client may close a transport connection between
them if either one detects the connection has been idle for some time.
Is it possible that one side starts closing a connection while the other
side is transmitting data via this connection? Explain.
It is possible that one side can close a connection while the other is
transmitting data. This is because the client and server only know the state
of each other after they have received data from each other. If a connection
is deemed idle by a party, it could be closed even though a message would
be underway from the opposite party. RFC2616 allows for this to happen,
says that if the client is denied connection while sending a message, it
should retry the request using the ‘binary exponential back-off’ algorithm to
be assured of obtaining a reliable response.
Source: http://www.w3.org/Protocols/rfc2616/rfc2616.html

Problem 7
Suppose within your Web browser you click on a link to obtain a Web
page. The IP address for the associated URL is not cached in your
local host, so a DNS lookup is necessary to obtain the IP address.
Suppose that n DNS servers are visited before your host receives the
IP address from DNS; the successive visits incur an RTT of RTT1, . . .,
RTTn. Further suppose that the Web page associated with the link
contains exactly one object, consisting of a small amount of HTML
text. Let RTT0 denote the RTT between the local host and the server
containing the object. Assuming zero transmission time of the object,
how much time elapses from when the client clicks on the link until the
client receives the object?
Two RTT0 are needed right away due to requesting the. connection and
requesting the URL.
This gives us 2RTT0
Each DNS Server visited along the way adds RTTs up to RTTn
This gives us SUM(RTT 1:n)
The object has 0 transmission time so it only needs to be requested.
This gives us RTTobject
We end up with:
RTTtotal = 2RTT0 + SUM(RTT 1:n) + RTTobject

Problem 10
Consider a short, 10-meter link, over which a sender can transmit at a
rate of 150 bits/sec in both directions. Suppose that packets
containing data are 100,000 bits long, and packets containing only
control (e.g., ACK or handshaking) are 200 bits long. Assume that N
parallel connections each get 1/N of the link bandwidth. Now consider
the HTTP protocol, and suppose that each downloaded object is 100
Kbits long, and that the initial downloaded object contains 10
referenced objects from the same sender. Would parallel downloads
via parallel instances of non-persistent HTTP make sense in this case?
Now consider persistent HTTP. Do you expect significant gains over
the non-persistent case? Justify and explain your answer.
Parallel instances of non-persistent HTTP in this case would split the
transmit rate to roughly 15bits/sec for each object. Each handshake would
take 1.5 more seconds.
Parallel instances can be seen as such: with t = transport time
200/150 + t + 200/150 + t + 100000/150 + 200/15 +t + 200/ 15 +t +
20015+t + 100000/15+ t = 400/150 + 100000/150 + 400/15 + 100000/15 +
8t = 7338.42 + 8t seconds
Persistent HTTP would require only one handshake, and would transmit
files back to back.
Persistent HTTP can be seen as such: with t = transport time
2(200/150 + t) + 10(100000/150 + t) = 400/150 + 4t +1000000/150 + 10t =
6669.3 + 14t seconds
So from this, we can see that persistent HTTP is definitely the better way to
go because its a few minutes quicker. Also, with persistent HTTP, we don’t
have to worry about some of our connections waiting to be serveed because
we only have one constant connection as opposed to a bunch.

Problem 15
Read RFC 5321 for SMTP. What does MTA stand for? Consider the
following received spam email (modified from a real spam email).
Assuming only the originator of this spam email is malacious and all
other hosts are honest, identify the malacious host that has generated
this spam email.
From – Fri Nov 07 13:41:30 2008
Return-Path: <tennis5@pp33head.com>
Received: from barmail.cs.umass.edu
(barmail.cs.umass.edu [128.119.240.3]) by cs.umass.edu
(8.13.1/8.12.6) for <hg@cs.umass.edu>; Fri, 7 Nov 2008
13:27:10 -0500
Received: from asusus-4b96 (localhost [127.0.0.1]) by
barmail.cs.umass.edu (Spam Firewall) for
<hg@cs.umass.edu>; Fri, 7 Nov 2008 13:27:07 -0500
(EST)
Received: from asusus-4b96 ([58.88.21.177]) by
barmail.cs.umass.edu for <hg@cs.umass.edu>; Fri,
07 Nov 2008 13:27:07 -0500 (EST)
Received: from [58.88.21.177] by
inbnd55.exchangeddd.com; Sat, 8 Nov 2008 01:27:07 +0700
From: “Jonny” <tennis5@pp33head.com>
To: <hg@cs.umass.edu>
Subject: How to secure your savings
 Advertisements

Report this ad

Report this ad

Share this:

 Twitter  Facebook 1

 Like
Be the first to like this.

Leave a Reply
 Enter your comment here...

Blog at WordPress.com.